CODEWITHSUNDEEP
c#asp.net-coreasp.net-identity
SBU
SBU

Reputation: 368

Asp.NET Core Claim based Authorization

I was using Role-based authorization for asp since now. I wanted to learn Policy-based and claim-based authorizations. Then I realized I can turn claims into something like "Permission based api authorization" which I am using for NodeJs. I have 2 questions to understand the fundamentals, thank you.

Question 1: The scenario in my mind is this: Users have roles, and roles have claims. Then I will add Authorization policies which require claims. Is this a correct approach? Basically users won't have claims. (I have seen many approaches on net, that's why I am asking)

Question 2: To do that I created tables with switches. I will add a photo to so you can picture the scenario easily. But when I use:

var role = await roleManager.FindByIdAsync(RoleId);
await roleManager.AddClaimAsync(role,new Claim("Permission 1", "perm explanation"));
List<IdentityRoleClaim<string>> allClaims = _db.RoleClaims.ToList();

this block of code doesn't check duplication check for Claim which will be added to database. We can use RoleManager and UserManager, but is there a Manager for claims? Thank you again.

Upvotes: 1

Views: 823

Answers (1)

Gordon Khanh Ng.
Gordon Khanh Ng.

Reputation: 1680

There's many way to solve authorization problem, what you are asking tended to optionality, best solution would be difference based on various usecases and the developer, who implement them themself. Since I was use all role, claim and policy, I'll giving my answers as advises.

The scenario in my mind is this: Users have roles, and roles have claims. Then I will add Authorization policies which require claims. Is this a correct approach? Basically users won't have claims. (I have seen many approaches on net, that's why I am asking)

Think of role as A BIG CLAIM. Whenever you saw a role, you grant them permission to do some stuffs. Like a when you entering a building, the security would have the permisions to check your basic personal information. It doesn't matter who the security is, they have the permisions to ask for your paper as long as they performed in security role.

To do that I created tables with switches. I will add a photo to so you can picture the scenario easily.

Have you saw something in jwt token like

"someCustomClaim": ["ClaimOne", "ClaimTwo", "ClaimThree"],

Think of how this claim will be preserve in a relational database like sql, that's why there is not an unique index there. But, you can always add one, and enforce each claim are unique, or each role+claim is unique,... all is up to your use cases.

We can use RoleManager and UserManager, but is there a Manager for claims?

Claims doesn't make any senses if they stand alone, it has to be attached with Role or User to be meaningful right ?

So UserManager(which have claims via UserClaims) and RoleManager(which have claims via RoleClaims) are good enough, even if you in a very-complex scenerio that require both Multiple Role - Claims and Claims that directly assign to an user.

And about Policy, that's the mixin way to solve complex authorization scenerios, like UserAuthenticated + Must have Internal Role + Must have Maintaination Claim + does not have fresher claim. If you need to authorize an endpoint kind of complex like this... you might consider to register those as policies.

Upvotes: 1

Related Questions